Re: [cti-stix] [jmg@newcontext.com: Observed Data comments.]

Thanks,

Bret

Bret Jordan CISSP

Director of Security Architecture and Standards | Office of the CTO

Blue Coat Systems

PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050

"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."

On Aug 30, 2016, at 12:25, John-Mark Gurney <jmg@newcontext.com> wrote:

Did this get lost in the shuffle last week? I didn't see any discussion
on this.

----- Forwarded message from John-Mark Gurney <jmg@newcontext.com> -----

Date: Mon, 22 Aug 2016 17:08:44 -0700
From: John-Mark Gurney <jmg@newcontext.com>
To: "cti-stix@lists.oasis-open.org" <cti-stix@lists.oasis-open.org>
Subject: Observed Data comments.

Hello,

Sorry for not getting this in sooner, but I have questions/comments
about the Observed Data object.

There is nothing in the spec that requires first_observed to be equal
to last_observed when number_observed is 1.

How is a tool who receives such an object to handle this?

In the case of when you don't know exactly when the observed data
was recorded, the _presision property added to first_observed can
convey this information correctly, and most acurately.

P.S. IMO, we should also make the number_observed default to 1, and
make it optional. By setting a resonable default, we can reduce
the size of objects in common cases.

--
John-Mark

----- End forwarded message -----

--
John-Mark

---------------------------------------------------------------------
To unsubscribe from this mail list, you must leave the OASIS TC that
generates this mail. Follow this link to all your TCs in OASIS at:
https://www.oasis-open.org/apps/org/workgroup/portal/my_workgroups.php

cti-stix message